[Ace] Fwd: New Version Notification for draft-tiloca-ace-revoked-token-notification-00.txt

Marco Tiloca <marco.tiloca@ri.se> Tue, 05 November 2019 11:09 UTC

Return-Path: <marco.tiloca@ri.se>
X-Original-To: ace@ietfa.amsl.com
Delivered-To: ace@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A05231208E2 for <ace@ietfa.amsl.com>; Tue, 5 Nov 2019 03:09:20 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pNOLOIUXazQB for <ace@ietfa.amsl.com>; Tue, 5 Nov 2019 03:09:17 -0800 (PST)
Received: from EUR02-AM5-obe.outbound.protection.outlook.com (mail-eopbgr00065.outbound.protection.outlook.com [40.107.0.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 037E5120894 for <ace@ietf.org>; Tue, 5 Nov 2019 03:09:16 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=JESsHp5ixg5Rue/CHg4wh3vkdyZKxRd7l3iOd4wIJhbotuxXZ4ChKhppKDcYBZrSMX5oAebCeSyGHLGQbwkMTUz3Pcg7L5JdGO0mlEiYL9+nyuHteTHBqO9n8s4nER5Kf4ndfzKdTuRS3Cr2O/XbFSyZ6Xxh1JigtOuYm4eyfMgt0s5YgPERfiS8VQ9jF2rm3784gYXlBxTbIMqcSh8mVG1sDLAKhP/XPxrpL40jwTAJuf3rO7sCoTuNwDewyGL9+GTSg1VSYh+9m/8tFhTNl8q+EtvB4PVXgnSIQha/44bJAkeYGUijY/A7GSeCGOSVV0aOLpKvjSyupGsiEULpTw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=zf7GPUvNCA5mZXqyxJpBap4GnLVVRF7HkSZJMcV97yA=; b=nUXYChUbLzxHMvtKqzKcJh4wRmtaa7IH1L03mohMGLnpwBGGarDt4beIr2qfvD98JdmyHe3cvIfMj0YX/9JGl1l9ZmLkCUnhZX6HHbUBxqgW/XsymHuf5AKBl3wFmmV5mvB3/eo4WhTwXQU9TcKN4J9Xdmmd3/mDFUCuFpq91L1ROztsD5loA6/xlB4b8+gMtRAgiJkOTr4Q3npxkQ0L5DxgnNaXL14ErqcFY3S4YNzDIKtgr2hPGYt9O7U0GqeuPoiLlu9H3TpO6byx3QYif4Y5+JBevFsMicmX9LHuLsC3r96EPl3KRNrtanRY2InAbMbCE/DEo25/JVvJWJTW7Q==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 194.218.146.197) smtp.rcpttodomain=ietf.org smtp.mailfrom=ri.se; dmarc=pass (p=none sp=none pct=100) action=none header.from=ri.se; dkim=none (message not signed); arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector1-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=zf7GPUvNCA5mZXqyxJpBap4GnLVVRF7HkSZJMcV97yA=; b=Sa4AIs+cQbvgqFdl4cdFgkE8ITOlxdel+WLKhWP9uZjMRz1Q+Z8ShfEkJeElt9bnBAEzKJiQ83TTAkl7ATvNukFuoqbqYEClXT5BlDCNBpHr+3W9Ri95qgQ3alr3PF9bcIraxOehM0vKue50CMrkCVl6WlIB5GhmbfesIFgIdUQ=
Received: from VI1P189CA0035.EURP189.PROD.OUTLOOK.COM (2603:10a6:802:2a::48) by HE1P18901MB0027.EURP189.PROD.OUTLOOK.COM (2603:10a6:3:9b::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2408.24; Tue, 5 Nov 2019 11:09:11 +0000
Received: from HE1EUR02FT008.eop-EUR02.prod.protection.outlook.com (2a01:111:f400:7e05::207) by VI1P189CA0035.outlook.office365.com (2603:10a6:802:2a::48) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2408.24 via Frontend Transport; Tue, 5 Nov 2019 11:09:11 +0000
Authentication-Results: spf=pass (sender IP is 194.218.146.197) smtp.mailfrom=ri.se; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=pass action=none header.from=ri.se;
Received-SPF: Pass (protection.outlook.com: domain of ri.se designates 194.218.146.197 as permitted sender) receiver=protection.outlook.com; client-ip=194.218.146.197; helo=mail.ri.se;
Received: from mail.ri.se (194.218.146.197) by HE1EUR02FT008.mail.protection.outlook.com (10.152.10.77) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.20.2387.20 via Frontend Transport; Tue, 5 Nov 2019 11:09:10 +0000
Received: from [10.8.3.8] (10.116.0.226) by sp-mail-2.sp.se (10.100.0.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1779.2; Tue, 5 Nov 2019 12:09:10 +0100
References: <157289555650.13868.8624534448888694215.idtracker@ietfa.amsl.com>
To: <ace@ietf.org>
From: Marco Tiloca <marco.tiloca@ri.se>
Openpgp: preference=signencrypt
Autocrypt: addr=marco.tiloca@ri.se; prefer-encrypt=mutual; keydata= mQENBFSNeRUBCAC44iazWzj/PE3TiAlBsaWna0JbdIAJFHB8PLrqthI0ZG7GnCLNR8ZhDz6Z aRDPC4FR3UcMhPgZpJIqa6Zi8yWYCqF7A7QhT7E1WdQR1G0+6xUEd0ZD+QBdf29pQadrVZAt 0G4CkUnq5H+Sm05aw2Cpv3JfsATVaemWmujnMTvZ3dFudCGNdsY6kPSVzMRyedX7ArLXyF+0 Kh1T4WUW6NHfEWltnzkcqRhn2NcZtADsxWrMBgZXkLE/dP67SnyFjWYpz7aNpxxA+mb5WBT+ NrSetJlljT0QOXrXMGh98GLfNnLAl6gJryE6MZazN5oxkJgkAep8SevFXzglj7CAsh4PABEB AAG0Nk1hcmNvIFRpbG9jYSAobWFyY28udGlsb2NhQHJpLnNlKSA8bWFyY28udGlsb2NhQHJp LnNlPokBNwQTAQgAIQUCWkAnkAIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRDuJmS0 DljaQwEvCACJKPJIPGH0oGnLJY4G1I2DgNiyVKt1H4kkc/eT8Bz9OSbAxgZo3Jky382e4Dba ayWrQRFen0aLSFuzbU4BX4O/YRSaIqUO3KwUNO1iTC65OHz0XirGohPUOsc0SEMtpm+4zfYG 7G8p35MK0h9gpwgGMG0j0mZX4RDjuywC88i1VxCwMWGaZRlUrPXkC3nqDDRcPtuEGpncWhAV Qt2ZqeyITv9KCUmDntmXLPe6vEXtOfI9Z3HeqeI8OkGwXpotVobgLa/mVmFj6EALDzj7HC2u tfgxECBJddmcDInrvGgTkZtXEVbyLQuiK20lJmYnmPWN8DXaVVaQ4XP/lXUrzoEzuQENBFSN eRUBCACWmp+k6LkY4/ey7eA7umYVc22iyVqAEXmywDYzEjewYwRcjTrH/Nx1EqwjIDuW+BBE oMLRZOHCgmjo6HRmWIutcYVCt9ieokultkor9BBoQVPiI+Tp51Op02ifkGcrEQNZi7q3fmOt hFZwZ6NJnUbA2bycaKZ8oClvDCQj6AjEydBPnS73UaEoDsqsGVjZwChfOMg5OyFm90QjpIw8 m0uDVcCzKKfxq3T/z7tyRgucIUe84EzBuuJBESEjK/hF0nR2LDh1ShD29FWrFZSNVVCVu1UY ZLAayf8oKKHHpM+whfjEYO4XsDpV4zQ15A+D15HRiHR6Adf4PDtPM1DCwggjABEBAAGJAR8E GAECAAkFAlSNeRUCGwwACgkQ7iZktA5Y2kPGEwf/WNjTy3z74vLmHycVsFXXoQ8W1+858mRy Ad0a8JYzY3xB7CVtqI3Hy894Qcw4H6G799A1OL9B1EeA8Yj3aOz0NbUyf5GW+iotr3h8+KIC OYZ34/BQaOLzdvDNmRoGHn+NeTzhF7eSeiPKi2jex+NVodhjOVGXw8EhYGkeZLvynHEboiLM 4TbyPbVR9HsdVqKGVTDxKSE3namo3kvtY6syRFIiUz5WzJfYAuqbt6m3TxDEb8sA9pzaLuhm fnJRc12H5NVZEZmE/EkJFTlkP4wnZyOSf/r2/Vd0iHauBwv57cpY6HFFMe7rvK4s7ME5zctO Ely5C6NCu1ZaNtdUuqDSPA==
X-Forwarded-Message-Id: <157289555650.13868.8624534448888694215.idtracker@ietfa.amsl.com>
Message-ID: <57445f36-47d9-1576-97d3-1f96a703557e@ri.se>
Date: Tue, 5 Nov 2019 12:09:09 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0
MIME-Version: 1.0
In-Reply-To: <157289555650.13868.8624534448888694215.idtracker@ietfa.amsl.com>
Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="oule5DjUvMgqV2olpMYz74LyizyTYDYJZ"
X-Originating-IP: [10.116.0.226]
X-ClientProxiedBy: sp-mail-1.sp.se (10.100.0.161) To sp-mail-2.sp.se (10.100.0.162)
X-EOPAttributedMessage: 0
X-Forefront-Antispam-Report: CIP:194.218.146.197; IPV:NLI; CTRY:SE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(346002)(136003)(39860400002)(376002)(396003)(189003)(199004)(606006)(3846002)(15650500001)(70586007)(6116002)(2351001)(31696002)(36756003)(26005)(316002)(33964004)(2616005)(386003)(126002)(21480400003)(40036005)(16576012)(11346002)(76176011)(6916009)(22756006)(336012)(446003)(5024004)(14444005)(16586007)(2906002)(70206006)(71190400001)(31686004)(58126008)(66574012)(22746008)(236005)(86362001)(478600001)(54896002)(2473003)(6306002)(966005)(106002)(65806001)(229853002)(476003)(7736002)(186003)(16526019)(44832011)(356004)(5660300002)(568964002)(81156014)(8936002)(81166006)(235185007)(65956001)(8676002)(486006); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1P18901MB0027; H:mail.ri.se; FPR:; SPF:Pass; LANG:en; PTR:InfoDomainNonexistent; MX:1; A:1;
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: b756ecba-d6ca-49a8-b4f1-08d761e095a7
X-MS-TrafficTypeDiagnostic: HE1P18901MB0027:
X-Microsoft-Antispam-PRVS: <HE1P18901MB00272F415BC50B2B9128C9C3997E0@HE1P18901MB0027.EURP189.PROD.OUTLOOK.COM>
X-MS-Oob-TLC-OOBClassifiers: OLM:9508;
X-Forefront-PRVS: 0212BDE3BE
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: hu4A6YX/pUMKUwCrJitQVSgHXGpnk0ISc1xTeN5I8bTv9nROfrnDn1hRAtX4an2BWjSlgRaSk/t+Yys/d44CFUi8lrmcJVgaEbqBDqni9QM4hS2Li2cKrZF4imB4YxSYuicEhHEMsRJnPc4qH3vwQ1GG/phsEI2tXf3cNUxMhuVztMGCJo/g6Ugzp53UTI5ehKHLIbZkMfA6K2W+0fxd5sRZPa+PG5A4Pd9JmwMOQvtWmTxjCUMlvIRdtJAmv4zpztklRLkQJS2bMRepsoxWlfO4moQt0qwJfyvxa4eXxOVmWj4ebmZsgPzI9EdWUB3VMoS2Zavx8uCn3XJGQ6J6CYUY90AU6xOQ7oxr6a9X0PB3g//g2/Hv2XpSLDVYKR5EnHMkO6iZqstEggp3mHjvLuG2YfNa2xnvQWgtcSpp7gbv1AcGTZrnpU0n16BoBwHN
X-OriginatorOrg: ri.se
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Nov 2019 11:09:10.6918 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: b756ecba-d6ca-49a8-b4f1-08d761e095a7
X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5a9809cf-0bcb-413a-838a-09ecc40cc9e8; Ip=[194.218.146.197]; Helo=[mail.ri.se]
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1P18901MB0027
Archived-At: <https://mailarchive.ietf.org/arch/msg/ace/RogYzAkNBWc8d2wUB53_SsSPtkg>
Subject: [Ace] Fwd: New Version Notification for draft-tiloca-ace-revoked-token-notification-00.txt
X-BeenThere: ace@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" <ace.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ace>, <mailto:ace-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ace/>
List-Post: <mailto:ace@ietf.org>
List-Help: <mailto:ace-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ace>, <mailto:ace-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 05 Nov 2019 11:09:21 -0000

Hello ACE,

We have recently submitted a new draft "Notification of Revoked Access
Tokens in the Authentication and Authorization for Constrained
Environments (ACE) Framework".

https://tools.ietf.org/html/draft-tiloca-ace-revoked-token-notification

The document describes how an Authorization Server can notify Clients
and Resource Servers of revoked but yet not expired Access Tokens. This
is achieved by means of device-specific Token Revocation List (TRL)
resources at the AS, that the associated device can access and observe
by using resource observation for CoAP.

This approach complements token introspection at the AS, and does not
require additional endpoints on Clients and Resource Servers.

Comments are very welcome.

Best,
/Marco


-------- Forwarded Message --------
Subject: 	New Version Notification for
draft-tiloca-ace-revoked-token-notification-00.txt
Date: 	Mon, 4 Nov 2019 11:25:56 -0800
From: 	internet-drafts@ietf.org
To: 	Ludwig Seitz <ludwig.seitz@ri.se>;, Grace Lewis
<glewis@sei.cmu.edu>;, Sebastian Echeverria <secheverria@sei.cmu.edu>;,
Marco Tiloca <marco.tiloca@ri.se>;, Francesca Palombini
<francesca.palombini@ericsson.com>;




A new version of I-D, draft-tiloca-ace-revoked-token-notification-00.txt
has been successfully submitted by Marco Tiloca and posted to the
IETF repository.

Name: draft-tiloca-ace-revoked-token-notification
Revision: 00
Title: Notification of Revoked Access Tokens in the Authentication and
Authorization for Constrained Environments (ACE) Framework
Document date: 2019-11-04
Group: Individual Submission
Pages: 10
URL:
https://www.ietf.org/internet-drafts/draft-tiloca-ace-revoked-token-notification-00.txt
Status:
https://datatracker.ietf.org/doc/draft-tiloca-ace-revoked-token-notification/
Htmlized:
https://tools.ietf.org/html/draft-tiloca-ace-revoked-token-notification-00
Htmlized:
https://datatracker.ietf.org/doc/html/draft-tiloca-ace-revoked-token-notification


Abstract:
This document specifies a method of the Authentication and
Authorization for Constrained Environments (ACE) framework, which
allows an Authorization Server to notify Clients and Resource Servers
(i.e., registered devices) about revoked Access Tokens. The method
relies on resource observation for the Constrained Application
Protocol (CoAP), with Clients and Resource Servers observing a
dedicated, device-specific Token Revocation List on the Authorization
Server. Resulting unsolicited notifications of revoked Access Tokens
complement alternative approaches such as token introspection, while
not requiring additional endpoints on Clients and Resource Servers.



Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat